IIA Certified Internal Auditor - Part 3: Internal Audit Function (CIA-3) practice questions

The board of a large organisation wants assurance that the internal audit function's external assessment obligation under its quality assurance and improvement program is being met correctly. Which approach satisfies that obligation?

• AEither a full external assessment or a self-assessment with independent external validation, conducted at least once every five years by a qualified reviewer from outside the organisation.check_circle Correct
• BOnly a full external assessment performed every year by a reviewer who is employed elsewhere within the same organisation but outside the audit team.
• CA periodic self-assessment signed off by the chief audit executive alone, provided that the function repeats the exercise at least every three years.
• DOngoing monitoring supplemented by a stakeholder survey, provided that senior management approves the scope of the review beforehand.

Why A is correct: This is correct: the obligation may be met by a full external assessment or by a validated self-assessment, performed at least every five years by a qualified, independent outside reviewer.

Why B is wrong: An annual cadence is stricter than required and a reviewer from inside the same organisation is not independent of it, so this fails the independence expectation.

Why C is wrong: A self-assessment without independent external validation is an internal activity; the chief audit executive's sign-off does not supply the external independence the obligation requires.

Why D is wrong: Ongoing monitoring and surveys are internal in nature and do not deliver an independent external judgement, so management approval of scope does not turn them into an external assessment.

A chief audit executive at Kelmscott Water is building next year's programme of work. She has drawn up a full inventory of every auditable entity, process, and system across the organisation, and separately a list of the specific engagements she intends to resource and schedule over the coming twelve months. A new manager treats these two documents as the same thing. How should the chief audit executive distinguish the audit universe from the annual audit plan?

• AThe audit universe is the risk-prioritised set of engagements approved for the year, while the audit plan is the broader catalogue of everything that could be audited.
• BThe audit universe and the audit plan are alternative names for the same risk-ranked schedule, differing only in whether the audit committee has formally approved it.
• CThe audit universe lists only the engagements requested by management, while the audit plan lists only the engagements requested by the audit committee.
• DThe audit universe is the full inventory of auditable areas across the organisation, while the audit plan is the risk-prioritised subset the function will actually resource and perform in the period.check_circle Correct

Why A is wrong: This inverts the two terms; it is tempting because both concepts involve lists, but the universe is the full catalogue and the plan is the selected, scheduled subset.

Why B is wrong: Approval status does not turn one document into the other; the two are genuinely different artefacts, so treating them as synonyms misses the population-versus-selection distinction.

Why C is wrong: Both artefacts are owned and shaped by the internal audit function using a risk assessment, not split by who requested each engagement, so this mischaracterises how both are built.

Why D is correct: Correct: the universe is the complete population of potential engagements, and the plan is the prioritised selection scheduled and resourced for the period, informed by a risk assessment.

Halden Water Services' internal audit team uncovers, midway through an engagement, evidence that a manager has been circumventing procurement controls and exposing the organisation to continuing loss. The final engagement report is not due for another six weeks. What should the chief audit executive do to keep the communication timely?

• AWait until the final report is issued so the matter can be presented with full context and a documented management response.
• BCommunicate the matter promptly to senior management and the board so corrective action can be taken ahead of the final report.check_circle Correct
• CAdd the matter to the next quarterly summary sent to the finance director for consolidation with the period's other findings.
• DHold the finding until fieldwork closes and then compress the report timetable by shortening the management response period.

Why A is wrong: Bundling the matter into the final report feels tidy, but timeliness means communicating significant findings soon enough for action, and a six-week delay lets a known loss continue.

Why B is correct: Timely communication means issuing interim results when a finding is significant enough to warrant action before fieldwork closes, and routing it to management and the board preserves the reporting line and enables a fast response.

Why C is wrong: A quarterly roll-up to a single manager is neither timely nor directed to the right level, and it delays action on an issue that is already causing loss.

Why D is wrong: Squeezing the later timetable still leaves weeks of continuing loss untreated and trades a genuine interim communication for a rushed final one.